CVE-2004-1649

Technical details about CVE-2004-1649 are not publicly provided in the supplied documents; no affected products, versions, or fixes are disclosed here. Monitor for updates.

CVE-2004-1689

The CVE-2004-1689 entry concerns sudoedit (sudo -e) on sudo 1.6.8, where a temporary file is opened with root privileges and can be read by local users through a symlink attack on the temporary file before quit. This is a local privilege issue affecting the sudoedit workflow, enabling access to a...

CVE-2004-1624

CVE-2004-1624 affects Carbon Copy 6.0.5257. The issue: CCW32.exe (help topic interface) launches external programs (Notepad) without dropping system privileges, and the Carbon Copy Scheduler (CCSched.exe) help button similarly spawns external processes. Root cause: failure to drop privileges when...

CVE-2004-1556

The CVE-2004-1556 entry concerns MyWebServer 1.0.3 and describes a remote denial-of-service (application crash) caused by a large number of connections in a short time. The available sources confirm the affected product and behavior but do not provide root-cause analysis, exploit details, specifi...

CVE-2004-1637

The CVE-2004-1637 entry concerns the Hawking Technologies HAR11A modem/router. The affected component is the device itself, where remote attackers can connect to port 254 to view a management interface and information on established connections, exposing sensitive information. The NVD metrics ass...

CVE-2004-1629

CVE-2004-1629 describes multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier, allowing remote attackers to execute arbitrary SQL statements. The available sources list this as a remote vulnerability with network attack vector and no authentication required, but the connected doc...

CVE-2004-1660

CVE-2004-1660 affects CuteNews 1.3.6 and earlier. The vulnerability is a PHP remote file inclusion via the cutepath parameter to show_archives.php or show_news.php, enabling remote code execution. Public references (NVD entry) confirm the affected software, vulnerability class, and attack vector ...

CVE-2004-1559

CVE-2004-1559 refers to multiple cross-site scripting (XSS) vulnerabilities in WordPress 1.2 . The issues allow remote attackers to inject arbitrary script/HTML via various parameters across several pages: (1) wp-login.php (redirect_to, text, popupurl, popuptitle), (2) admin-header.php (redirect_...

CVE-2004-1644

CVE-2004-1644 affects Xedus Peer-to-Peer webserver (Xedus 1.0). The vulnerability allows a remote attacker to cause a denial of service by opening multiple connections from the same IP, leading to the webserver refusing new connections. This is a network-based DoS with partial availability impact...

CVE-2004-1573

The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator...

CVE-2004-1663

Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 formerly FastT 100 and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service freeze and possible data corruption via crafted TCP packets...

CVE-2004-1634

showbug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information...

CVE-2004-1612

Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. dot dot in a ProcessQueueFile request...

CVE-2004-1646

Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the URL...

CVE-2004-1680

application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service VxWorks OS crash via a long HTTP GET request, possibly triggering a buffer overflow...

CVE-2004-1579

index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid catid parameter, which reveals the full path in a PHP error message...

CVE-2004-1665

Cross-site scripting XSS vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the no parameter...

CVE-2004-1685

The CVE-2004-1685 issue affects SMC routers: SMC7004VWBR (firmware 1.00.014) and SMC7008ABR EU (firmware 1.42.003). Root cause: authentication bypass by a remote attacker who connects from the same IP address as the administrator currently logged in, then accesses setup_status.htm or status.HTM. ...

CVE-2004-1617

CVE-2004-1617 affects Lynx family (lynx, lynx-ssl, lynx-cur) prior to 2.8.6dev.8. Affected component is the HTML parser: processing invalid HTML (notably a TEXTAREA with a large COLS value, or an unterminated large tag name) can cause an infinite loop, i.e., a denial of service. Debians OpenVAS e...

CVE-2004-1592

The CVE-2004-1592 entry concerns ocPortal (index.php) remote file inclusion. Affected software is ocPortal 1.0.3 and earlier; the vulnerability arises from a flaw in the req_path parameter, which can be manipulated to reference a URL on a remote server containing a malicious funcs.php, enabling r...